Proxies

The client exposes an agent’s proxy services on the operator workstation. They bind to the loopback interface by default.

Prerequisites

The agent must be online with the corresponding proxy enabled, and its SSH data path must be working.

Quick usage

Open an SSH session with the default local proxy forwards:

tealc ssh AGENT_NAME

To expose only SOCKS and HTTP without opening a shell, use:

tealc socks AGENT_NAME

SOCKS proxy

Exposed by default on the port 1080.

See Agent SOCKS proxy for details.

HTTP proxy

Exposed by default on the port 3128.

See Agent HTTP proxy for details.

HTTP proxy with NTLM/Kerberos application-level authentication

Exposed by default on the port 3129.

See Agent HTTP proxy with NTLM/Kerberos authentication for details.

WireGuard

Exposed by default on the port 51820.

See WireGuard for configuration options and usage details.

Configurable ports and toggles

All proxies are configurable via flags on the tealc ssh command:

• --[no-]socks, --socks-port=1080: enable/disable SOCKS and set its port
• --[no-]http, --http-port=3128: enable/disable HTTP and set its port
• --[no-]http-mitm, --http-mitm-port=3129: enable/disable MITM HTTP and set its port
• --[no-]wg, --wg-port=51820: enable/disable WireGuard and set its port

See SSH for the full flag reference.

Security notes

Keep proxy listeners on loopback unless another host explicitly requires access. Traffic sent through these listeners is able to reach services from the agent’s network position and should be treated as authorized target traffic.